Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

影響: npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite-plus >= 0.2.8, <= 1.0.0 → 1.1.0

The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the [server.host](https://vite.dev/config/server-options#server-host) option - there's a file that has a sensitive information in the first 4 bytes - uses Node.js or Deno to run Vite (if Bun is used, it is not affe…

GitHub Advisory Database에서 읽기

2026. 10. 22. 오전 01:47, GitHub Advisory Database에서 "Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js, Deno. CVE: CVE-2026-112947.